Log in

View Full Version : SoftICE doesn't work on Windows XP beta


Solomon
April 18th, 2001, 21:46
My SoftICE is from DriverStudio v2.01.
I installed it on XP beta, the breakpoint doesn't work.
I heard that M$ has changed the system call instruction(the original is INT 2Eh) in XP, is it true?

D-G-R
April 20th, 2001, 02:58
Hmmm, u mean u can install it and ctrl^d into it but the breakpoints just don't trigger...? If so, I'll give it a shot and find out. To check if what u think is true try hexeditng the value of the breakpoint (0x2e as u think) into an app and see if softice triggers... Else, try the same for the old breakpoint value.

Anywayz, I think I'll give it a shot as well... as soon as I get confirmed that u can normally install it.

Take care,

D.

Solomon
April 22nd, 2001, 21:14
sorry my previous post was not detailed.
SoftICE from DriverStudio v2.01 Final can be installed in WinXP beta 2462a, and no problem when setting a breakpoint with API name. It pops up as usual when CTRL-D hit. But it can't break when the API is called.

This code snippet is from ntoskrnl.exe of Win2K build 2195:

Exported fn(): ZwCreateFile - Ord:0416h
:004009C6 B820000000 mov eax, 00000020
:004009CB 8D542404 lea edx, dword ptr [esp+04]
:004009CF CD2E int 2E
:004009D1 C22C00 ret 002C

while the following is from ntoskrnl.exe of WinXP beta 2:

Exported fn(): ZwCreateFile - Ord:04D3h
:0043B211 B825000000 mov eax, 00000025
:0043B216 8D542404 lea edx, dword ptr [esp+04]
:0043B21A 9C pushfd
:0043B21B 6A08 push 00000008
:0043B21D E8EF89FEFF call 00423C11
:0043B222 C22C00 ret 002C

The "call 00423C11" seems to be "call KiSystemService", coz I have compared the above code at CS:00423C11 with the code of KiSystemService( ) from Win2K.
INT 2EH disappeared in WinXP?

DGR
April 24th, 2001, 07:15
Hey, I just saw on the numega page that there's an update ntice.sys for softice in order to get it to work on windowsxp beta2 (2462)... u can find it here:

http://www.numega.com/drivercentral/icecentral.asp

Gonna install XP again in a few and try it out : )

Take care

DGR
April 24th, 2001, 10:01
Woop : )

Just installed XP (and Softice) and with the special ntice.sys for WindowsXP it actually seems to work. Atleast it worked with a "bpx destroywindow" hehe.

So I'd say try it out... and now I can finally run XP as my sole OS

Take care

Solomon
April 25th, 2001, 00:32
hehe, thx DGR. I will try the new driver too.

DGR
April 25th, 2001, 06:51
Blah, nevermind...

It does seem to work, somewhat but imo it's not really of any use yet. Breakpoints do work, sometimes... hard to say when they will and when they won't (most often they won't in my case). Meaning... when u do a "bpx Messageboxa" it sometimes snaps... but for the exact same app/situation the next time it won't.

Also when it does snap doing a "p ret" doesn't have the desirable result. Meaning, it won't go back to softice... the app just continues and u lost control again.

All in all, it's good to see that softice doesn't lock things up but it's too bad that it isn't worthy of using yet on this OS (which I really do like, heh).

Take care,

D.

matthew
December 10th, 2001, 20:32
does anybody know where i can get the update for softice 4.05 to make it work in windows xp? the previously posted link doesnt work.. and i havent been able to find anything in their site.

Solomon
December 10th, 2001, 21:21
Get DriverStudio 2.5 somewhere or wait for DS v2.6
That's the best choice

Quote:
Originally posted by matthew
does anybody know where i can get the update for softice 4.05 to make it work in windows xp? the previously posted link doesnt work.. and i havent been able to find anything in their site.

matthew
December 12th, 2001, 00:29
Does driver studio have a newer version of Softice then?
Looks like it from what I can see at the numega site.